<p dir="ltr">Bite the bullet and look at freeIPA. It's designed to run AD out of the workplace.<br>
The clincher for me was the hostgroup. All users are in a primary group and as many secondary groups as needed. Hosts are also in groups or not. User groups of the proper type can access host groups as allowed. This can also setup sudo capabilities by user, user group, host and host group. So a script that runs as root that does a particular needed task can be deployed to all systems but only accessed by allowed users on allowed hosts. Time controls exist as well.</p>
<p dir="ltr">Backups of freeIPA are a bit unnerving. They basically don't exist other than turn down the service and copy all files. What is used is the multi master replication.</p>
<p dir="ltr">I have 2 primary masters that are department wide. There's a new group in a remote location that has their own big server. It's a secondary master. Masters run DNS as well as user with. So the clients in that group use that as their primary DNS and the others as secondary. If network is flaky, they have only a single switch between client and server. And the server stays synchronized with the larger group. <br>
A really nice feature if freeIPA is it can hold ssh pub keys for users. SSh and Pam knows to check the LDAP for pub keys on login. For users, no more key migration. If you're allowed on that machine, it just works. For admins, if a user must be locked out, just dumping their key and locking the account to disabled handles it.</p>
<p dir="ltr">Yes, it's run/funded by RedHat now. Debian supports it but I found some blockers in Ubuntu (10 I think. Not tried 12). I don't know if SUSE has a pam/ssh compatible or not.<br>
It works. It works very well. Active support community with developers on the mailing list who help.</p>
<p dir="ltr">Added bonus is dogtag is used for CA and cert management. This can provide user certs for authenticated access to internal websites.</p>
<div class="gmail_quote">On Aug 22, 2014 6:58 AM, "JD" <<a href="mailto:jdp@algoloma.com">jdp@algoloma.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 08/22/2014 12:19 AM, Jeff Hubbs wrote:<br>
> On 8/21/14, 11:43 PM, JD wrote:<br>
>> NIS if you don't care about security.<br>
>><br>
>> LDAP if you do. FreeIPA is the RH answer for this - I'm jealous.<br>
> Agree re LDAP; if you're syncing passwd/group/sudoers files, you're Doing It<br>
> Wrong (tm). I long advocated avoiding "X's LDAP solution" (for values of X to<br>
> include Red Hat and Microsoft) so you are motivated to keep things simple and<br>
> manageable and don't wind up in abandonwareland or experience<br>
> embrace/extend/extinguish.<br>
><br>
<br>
So - if not puppet/ansible - then how should we be managing sudoers?<br>
Teach me Obiwan.<br>
<br>
Please don't say eTrust. ;)<br>
_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
</blockquote></div>